Examkin

Question

Difficulty: HardRole Hierarchy and Sharing Rules

Apex Global Logistics tracks cargo shipments using a custom object named `Shipment_Manifest__c`. The Organization-Wide Default (OWD) for `Shipment_Manifest__c` is set to Private, and the Grant Access Using Hierarchies setting has been explicitly deselected on the object for strict security compliance.

The system administrator is tasked with meeting two new record access requirements:
1. The VP of Operations must be able to view all `Shipment_Manifest__c` records created by users assigned to the Dispatch Manager role.
2. A cross-departmental Compliance Audit Team must have Read/Write access to any `Shipment_Manifest__c` record where the `Hazardous_Material__c` checkbox field is set to True.

Which two administrative configurations should be implemented to meet these requirements while maintaining the principle of least privilege? (Select 2 options)

  1. Create an owner-based sharing rule on `Shipment_Manifest__c` that shares records owned by members of the Dispatch Manager role with the VP of Operations role.Answer
  2. Create a criteria-based sharing rule on `Shipment_Manifest__c` where `Hazardous_Material__c = True` that grants Read/Write access to a Public Group containing the Compliance Audit Team.Answer
  3. C
    Assign a Permission Set containing the 'View All' object-level permission for `Shipment_Manifest__c` to the VP of Operations user account.
  4. D
    Enable the 'Grant Access Using Hierarchies' checkbox within the individual role detail settings for the Dispatch Manager role.

Answer

The administrator must create an owner-based sharing rule to share records owned by the Dispatch Manager role with the VP of Operations role, and create a criteria-based sharing rule for Hazardous_Material__c = True granting Read/Write access to a Public Group containing the Compliance Audit Team.
The correct solution involves two distinct sharing rule configurations. First, because 'Grant Access Using Hierarchies' has been unchecked on the custom object's Organization-Wide Defaults, managers do not automatically gain access to subordinate records; thus, an owner-based sharing rule must be created to share records owned by the Dispatch Manager role with the VP of Operations role. Second, access based on field values (such as Hazardous_Material__c = True) requires a criteria-based sharing rule targeting a Public Group that contains the Compliance Audit Team members.

Step-by-Step Solution

1
Analyze the impact of deselecting 'Grant Access Using Hierarchies' on a custom object.
When 'Grant Access Using Hierarchies' is deselected on a custom object in OWD, users higher in the role hierarchy no longer automatically inherit access to records owned by or shared with their subordinates.
To grant the VP of Operations access to records owned by Dispatch Managers without altering the object-level OWD hierarchy setting, an owner-based sharing rule target vector must be established.
2
Determine the optimal mechanism for sharing records based on record field values across departments.
Criteria-based sharing rules allow sharing records meeting specific field criteria (e.g., Hazardous_Material__c = True) with specific Public Groups, Roles, or Territories.
Creating a Public Group for the Compliance Audit Team and linking it to a criteria-based sharing rule fulfills the cross-departmental access requirement adhering to least privilege.
3
Evaluate distractors against least privilege and system architecture boundaries.
'View All' permission grants global record visibility ignoring sharing rules, which violates least privilege. 'Grant Access Using Hierarchies' is an object-level setting, not a role-level property.
Eliminates incorrect configuration choices.

Key Concept

Interaction between Custom Object OWD Hierarchy Toggles, Owner-Based Sharing Rules, and Criteria-Based Sharing Rules
Rate this question

Topics

Role Hierarchy and Sharing Rules

More questions from this topic